mirror of
https://github.com/sredevopsorg/deepseek-kubernetes-sandbox.git
synced 2026-11-03 09:23:25 +00:00
2f959e6afb
Security audit of .github/workflows found a script-injection vector in the release workflow, over-broad token grants on non-publishing jobs, and downloaded tooling/manifests executed without integrity checks. - release: pass the tag/dispatch input through env instead of interpolating it into the validation script; default workflow permissions to contents:read - build-main/build-gateway: grant write scopes only to the build job - _build-image/codeql: stop persisting checkout credentials - ci/release: verify actionlint, hadolint and git-cliff against pinned SHA-256s - ci-manifests/e2e: verify upstream CRD manifests against versions.env pins - e2e: redact token material before uploading cluster diagnostics - docs: add workflow-security.md with controls, audit record and residual repository-setting recommendations Co-authored-by: SREDevOpsAgents <agents@sredevops.org>
69 lines
1.9 KiB
YAML
69 lines
1.9 KiB
YAML
# Development channel for the example gateway image: a merge that touches the
|
|
# gateway publishes ghcr.io/<owner>/<repo>/dsh-agents-as-a-service/gateway:main.
|
|
name: Build gateway image
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
branches: [main]
|
|
paths:
|
|
- examples/dsh-agents-as-a-service/gateway/**
|
|
- versions.env
|
|
- .github/workflows/build-gateway.yaml
|
|
- .github/workflows/_build-image.yaml
|
|
|
|
# Write scopes are granted to the build job only; every other job stays read-only.
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: build-gateway-${{ github.ref }}
|
|
cancel-in-progress: true
|
|
|
|
jobs:
|
|
meta:
|
|
name: Read versions
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 5
|
|
outputs:
|
|
identity: ${{ steps.meta.outputs.identity }}
|
|
gateway_image: ${{ steps.meta.outputs.gateway_image }}
|
|
steps:
|
|
- name: Checkout
|
|
uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
|
|
with:
|
|
persist-credentials: false
|
|
- name: Read versions.env
|
|
id: meta
|
|
shell: bash
|
|
run: |
|
|
set -euo pipefail
|
|
set -a
|
|
# shellcheck disable=SC1091
|
|
source versions.env
|
|
set +a
|
|
|
|
identity="$DSH_VERSION"
|
|
[ -z "$RELEASE_REVISION" ] || identity="$DSH_VERSION-$RELEASE_REVISION"
|
|
{
|
|
echo "identity=$identity"
|
|
echo "gateway_image=$GATEWAY_IMAGE"
|
|
} >> "$GITHUB_OUTPUT"
|
|
|
|
build:
|
|
name: Build and push gateway image
|
|
needs: meta
|
|
uses: ./.github/workflows/_build-image.yaml
|
|
permissions:
|
|
contents: read
|
|
packages: write
|
|
id-token: write
|
|
attestations: write
|
|
with:
|
|
image: ${{ needs.meta.outputs.gateway_image }}
|
|
version: ${{ needs.meta.outputs.identity }}
|
|
context: examples/dsh-agents-as-a-service/gateway
|
|
dockerfile: Dockerfile
|
|
tags: |
|
|
${{ needs.meta.outputs.gateway_image }}:main
|